Isolate the Cloudflare runtime package lane

[chubes4]

Closes #2430.

Summary

• give runtime-cloudflare an independently pinned install, build, check, test, package, and CI lane
• keep root commands as thin aliases while excluding Cloudflare assets and dependencies from the root CLI artifact
• derive the vendored runtime-core contract reproducibly and promote validated generations transactionally
• package the production Wrangler dependency graph and verify rootless development and production installs

Verification

• 45/45 transactional promotion tests
• 129/129 Cloudflare package tests
• native helper compile with -Wall -Wextra -Werror
• repository, root, and Cloudflare package boundaries
• TypeScript compile and all four Wrangler dry runs
• packed development/production install, build, tests, and production D1 bundle
• final independent blocking review: no findings

AI assistance

OpenAI GPT-5.6 Sol via OpenCode implemented the package isolation and transactional promotion changes, ran the verification matrix, and performed independent blocking reviews under Chris Huber's direction.